~ / search / GHSA-36g8-62qv-5957

GHSA-36g8-62qv-5957

TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-34358

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-core >= 9.0.0, < 9.5.48 9.5.48
Packagist typo3/cms-core >= 10.0.0, < 10.4.45 10.4.45
Packagist typo3/cms-core >= 11.0.0, < 11.5.37 11.5.37
Packagist typo3/cms-core >= 12.0.0, < 12.4.15 12.4.15
Packagist typo3/cms-core >= 13.0.0, < 13.1.1 13.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Problem The `ShowImageController` (_eID tx_cms_showpic_) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. ### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. #### ℹ️ **Strong security defaults - Manual actions required** The `frame` HTTP query parameter is now ignored, since it could not be used by core APIs. The new feature flag `security.frontend.allowInsecureFrameOptionInShowImageController` – which is disabled per default – can be used to reactivate the previous behavior. ### Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team members Benjamin Mack and Benjamin Franzke who fixed the issue. ### References * [TYPO3-CORE-SA-2024-010](https://typo3.org/security/advisory/typo3-core-sa-2024-010)

References

External links from the advisory. They lead to third-party sites.